THREAT ACTOR
LEAKEDDATA_
ActiveLEAKEDDATA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of LEAKEDDATA, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 77
- 2025 90
- 2024 47
Leak site mirrors
2 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
business-data-leaks.comLEAKED DATA snapshot · 2026-09-23 05:00 -
ep6pheij.comsnapshot · 2026-09-23 05:28
Recent victims
The 50 most recent victims claimed by LEAKEDDATA. Total in the index: 214.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-23 | Clark Hill | To be announced... |
| 2026-09-22 | B... | To be announced... |
| 2026-09-22 | Cozen O'Connor | To be announced... |
| 2026-09-22 | Q... | To be announced... |
| 2026-09-22 | W... | To be announced... |
| 2026-09-21 | Hogan Lovells Cadwalader | To be announced... |
| 2026-09-17 | W... B... | To be announced... |
| 2026-09-03 | P... S... | To be announced... |
| 2026-09-03 | A...en | To be announced... |
| 2026-09-03 | Se... | To be announced... |
| 2026-09-03 | Katten Muchin Rosenman | To be announced... |
| 2026-09-03 | Greenberg Traurig | To be announced... |
| 2026-09-02 | G... ...g | To be announced... |
| 2026-09-02 | S... M... | To be announced... |
| 2026-09-01 | Holland & Knight | Holland & Knight, headquartered in Tampa, Florida, and established in … |
| 2026-09-01 | H... ...s | To be announced... |
| 2026-08-27 | Ne...n M... | To be announced... |
| 2026-08-27 | Q... E... | To be announced... |
| 2026-08-27 | N... M... | To be announced... |
| 2026-08-27 | S... P... | To be announced... |
| 2026-08-27 | K... M... | To be announced... |
| 2026-08-27 | H... K... | To be announced... |
| 2026-08-27 | H... L... | To be announced... |
| 2026-08-27 | C... O... | To be announced... |
| 2026-08-27 | A... | To be announced... |
| 2026-08-20 | D... | To be announced... |
| 2026-08-18 | Troutman Pepper Locke | The second time we attacked Troutman Pepper Locke in a year (first tim… |
| 2026-08-14 | Reminger | Reminger Attorneys at Law is a law firm with a strong presence in Ohio… |
| 2026-08-13 | Riker Danzig Scherer Hyland & Perretti | Founded in 1882, Riker Danzig Scherer Hyland & Perretti is a law firm … |
| 2026-08-12 | Riker Danzig LLP | To be announced... |
| 2026-08-12 | D...s | To be announced... |
| 2026-08-11 | R...er | To be announced... |
| 2026-08-10 | R... D... | To be announced... |
| 2026-08-10 | T... P... L... | To be announced... |
| 2026-08-08 | Rutan & Tucker, LLP | Founded in 1909 and headquartered in Costa Mesa, California, Rutan & T… |
| 2026-08-08 | Floyd Skeren Manukian Langevin, LLP | Floyd Skeren Manukian Langevin, LLP is a multi-service law firm with t… |
| 2026-08-08 | Ropers Majeski PC | For more than 75 years, Ropers Majeski has provided high-quality legal… |
| 2026-08-08 | Farella Braun + Martel LLP | They offered $520,000 to keep the data from being published. Farella B… |
| 2026-08-08 | Sandberg Phoenix | Over 45 years providing superior legal services to clients of every si… |
| 2026-08-08 | Porter Wright | Founded in 1846, Porter Wright is a full-service law firm offering leg… |
| 2026-08-08 | Marshall Dennehey | They offered $100,000 to keep the data from being published. Founded i… |
| 2026-08-08 | Barclay Damon | They are offering 325,000 for the safety of their clients' data. Barcl… |
| 2026-08-08 | Fox Rothschild LLP | Fox Rothschild LLP is an AmLaw 100 full-service law firm built to serv… |
| 2026-08-08 | Mayer Brown | Mayer Brown is a distinctively global law firm, uniquely positioned to… |
| 2026-08-08 | Moses & Singer | They offered $250,000 to keep the data from being published........Mos… |
| 2026-04-17 | Fagen Friedman & Fulfrost LLP | |
| 2026-04-17 | F...n F...n & F... LLP | |
| 2026-04-17 | Cox, Castle & Nicholson LLP | |
| 2026-04-17 | Goulston & Storrs | |
| 2026-04-17 | Jones Day | Jones Day founded in 1893 and headquartered in Cleveland Ohio, is a gl… |
CONFIRMED ATTACKS
LeakedData confirmed attacks: 23 verified incidents
Ransomnews has verified 23 LeakedData incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from September 2024 to August 2026. United States accounts for 23 of them (100%). The most affected sector is legal, at 11 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 1; the outcome is unrecorded in the remaining 21. Where a figure was disclosed (18 cases), these incidents account for 430,493 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified LeakedData incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2026 | Greenberg Traurig, LLP | Legal | New York, United States | 150,000 | Unknown | Source |
| May 2026 | Fox Rothschild LLP | Legal | Pennsylvania, United States | 531 | Unknown | Source |
| May 2026 | Weil, Gotshal & Manges LLP | Legal | New York, United States | — | Yes | Source |
| April 2026 | Chartwell Law | Legal | Pennsylvania, United States | — | Unknown | Source |
| March 2026 | Jones Day | Legal | District of Columbia, United States | — | Unknown | Source |
| February 2026 | Plaza Home Mortgage | Finance | California, United States | 137,976 | Unknown | Source |
| February 2026 | Singleton Schreiber LLP | Legal | California, United States | 232 | Unknown | Source |
| February 2026 | Hawaii Employers' Mutual Insurance Co. (HEMIC) | Finance | Hawaii, United States | — | Unknown | Source |
| August 2025 | Moore & Van Allen PLLC | Legal | North Carolina, United States | 7,224 | Unknown | Source |
| April 2025 | McLaughlin & Stern, LLP | Legal | New York, United States | 52 | Unknown | Source |
| March 2025 | Liberty Tax Service | Finance | Virginia, United States | 88 | Unknown | Source |
| February 2025 | CRC Group (CRC Insurance Services, LLC) | Finance | Alabama, United States | 60,727 | Unknown | Source |
| February 2025 | Shutts & Bowen LLP | Legal | Florida, United States | 281 | Unknown | Source |
| January 2025 | The Roger Keith & Sons Insurance Agency | Finance | Massachusetts, United States | 884 | Unknown | Source |
| January 2025 | US Claims Capital, LLC | Finance | Florida, United States | 25,722 | Unknown | Source |
| January 2025 | Olinsky & Associates, PLLC (Olinsky Law Group) | Legal | New York, United States | 525 | No | Source |
| December 2024 | Atlas CPAs & Advisors PLLC | Finance | Arizona, United States | 982 | Unknown | Source |
| December 2024 | Black, Bashor & Porsch, LLP | Finance | Pennsylvania, United States | 4,953 | Unknown | Source |
| December 2024 | Kotz Sangster Wysocki P.C. | Legal | Michigan, United States | 8,460 | Unknown | Source |
| November 2024 | Cross Valley Federal Credit Union | Finance | Pennsylvania, United States | 17,826 | Unknown | Source |
| October 2024 | Palomar Insurance Corporation | Finance | Alabama, United States | — | Unknown | Source |
| October 2024 | Metro Public Adjustment, Inc. | Finance | Pennsylvania, United States | 2,060 | Unknown | Source |
| September 2024 | Jacobs Entertainment, Inc. (JEI) | Other | Colorado, United States | 11,970 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from LeakedData's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.